#Tomcat vulnerability 2022 software#
#Tomcat vulnerability 2022 code#
#Tomcat vulnerability 2022 series#

ConfigurationBuilder News broke on March 30, 2022, of a new vulnerability.

And it’s still not patched in Tomcat 6.x or 8.0.x, though those have hit end of life.

cpe:2.3:a:apache_foundation:apache_tomcat:10.1. CVE-2022-23181 Detail Description The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. Im using the war distribution on my own Tomcat installation (Tomcat 6. This vulnerability was just announced recently. CVE-2022-23181 Detail Description The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.

#Tomcat vulnerability 2022 software#

Vulnerable software versionsĪpache Tomcat: 8.5.38 - 10.1.0-M14 CPE2.3 A remote attacker can perform a denial of service attack against the exposed EncryptInterceptor. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service. The vulnerability exists due to an error in documentation for the EncryptInterceptor, which incorrectly stated that it enabled Tomcat clustering to run over an untrusted network. Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. The issue was made public on 20 February 2023. This issue was reported to the Apache Tomcat Security team on 11 December 2022.

#Tomcat vulnerability 2022 series#

This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.The vulnerability allows a remote attacker to perform DoS attack. This resulted in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Necessarily indicate when this vulnerability wasĭiscovered, shared with the affected vendor, publicly The CVE ID was allocated or reserved, and does not The list is not intended to be complete.ĭisclaimer: The record creation date may reflect when The Apache Tomcat JsonErrorReportValve Injection Vulnerability, identified as CVE-202245143, is a security vulnerability that affects certain versions of.

#Tomcat vulnerability 2022 code#

This JSP could then be requested and any code it contained would be executed by the server. Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. DESCRIPTION: Apache Tomcat is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. Apache Tomcat Remote Code Execution Vulnerability: When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors.

The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed.